Detects log file that contains system reconnaissance data, seen being generated by Katz stealer

Hunt Hypothesis

This rule detects the creation of log files containing system reconnaissance data indicative of Katz Stealer’s initial information gathering phase to map the victim environment. Proactively hunting for this behavior in Azure Sentinel is critical because identifying these early-stage artifacts allows the SOC team to isolate compromised hosts before the adversary proceeds to credential theft and lateral movement.

YARA Rule

rule SUSP_Katz_Log_May25 {
   meta:
      description = "Detects log file that contains system reconnaissance data, seen being generated by Katz stealer"
      author = "MalGamy"
      date = "2025-05-20"
      reference = "Internal Research"
      hash = "1ac196ac6393d786618c944a7ab77fb189a6b4ba00af5c0f987c3dc65876c060"
      hash = "ad76e2727469525dec7e56977589dd250ca57a29b8b0d42cd5c42e536c285241"
      hash = "e1a0d6929662bcbc9e5e0827cb8b6d7818088e996cf971d2a4a1c1ca4208e533"
      hash = "b10796c41e1cec7c84a3c68bfcaa7b20f49b620d1c94304a6b3ed73471fa9031"
      hash = "5a984e2e308fe84e4e2071dd877772361719ba0217c2c23da79dbb82dc15eac8"
      score = 65
      id = "be56f0ae-e444-569e-95d7-edccf4c6dd2b"
   strings:
      $s1 = "Motherboard Manufacturer:" ascii
      $s2 = "===== System Information =====" ascii
      $s3 = "Volume Name:" ascii
      $s4 = "Desktop Hostname:" ascii
   condition:
      filesize < 50KB
      and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Katz Stealer Reconnaissance detection rule, including suggested filters and exclusions:

• Scenario: Endpoint Protection Scanning Artifacts

  • Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black frequently generate detailed system inventory logs during their scheduled daily scans. These logs often contain JSON or XML structures listing running processes, installed services, and network interfaces that mimic the reconnaissance data structure of Katz Stealer.
  • Filter/Exclusion: Exclude file paths originating from known EDR installation directories (e.g., C:\Program Files\CrowdStrike\ or C:\Windows\System32\Microsoft Defender). Additionally, filter out events where the process name matches the specific EDR agent executable (e.g., csagent.exe, MsMpEng.exe) regardless of the log content.

• Scenario: Scheduled IT Asset Inventory Jobs

  • Context: Automated asset management tools such as LANDesk, ServiceNow Discovery, or custom PowerShell scripts run via Task Scheduler to gather hardware and software inventory. These jobs often write reconnaissance reports (listing CPU info, RAM, OS version) to temporary log files in the C:\ProgramData or user profile directories, triggering the rule due to the presence of system metadata.
  • Filter/Exclusion: Create an exclusion for processes running under specific service accounts dedicated to inventory tasks (e.g., DOMAIN\svc-inventory, SYSTEM). Furthermore, filter out log files generated within standard inventory output folders like C:\ProgramData\LANDesk or C:\Temp\AssetInventory.

• Scenario: Application Deployment and Configuration Drift Checks

  • Context: DevOps tools like Ansible,